PT-2026-102439
CVE-2026-97685
·
Published
2026-09-29
·
Updated
2026-09-29
Description by
CVSS 4.0
7.1
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
LimeSurvey Community Edition version 7.3.0
Description
An authenticated user with permissions to create surveys can manipulate the REST survey-patching endpoint. While the system verifies the user's permission against the survey ID in the request URL, the persistence operations resolve target objects using global
qid (question identifier) or aid (answer identifier) without verifying if these objects belong to the authorized survey. This allows a user to modify questions or answers belonging to another user's survey.Recommendations
Update LimeSurvey Community Edition to a version newer than 7.3.0.
As a temporary mitigation, restrict access to the REST survey-patching endpoint for users who do not require survey modification privileges.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾